Security

1
Security
2
FreeBSD Security Advisories

• http//www.freebsd.org/security/advisories.html

3
FreeBSD Security Advisories

• Advisory
• Security information
• Where to find it
• Web page (Security Advisories Channel)
• http//www.freebsd.org

4
FreeBSD Security Advisories

• Where to find it
• freebsd-security-notifications Mailing list
• http//lists.freebsd.org/mailman/listinfo/freebsd-
  security-notifications

5
FreeBSD SecurityAdvisories

• Example
• openssl

6
FreeBSD SecurityAdvisories

• CVE-2010-3864
• http//web.nvd.nist.gov/view/vuln/detail?vulnIdCV
  E-2010-3864

7
FreeBSD Security Advisories

• Example
• Problem Description

8
FreeBSD Security Advisories

• Example
• Workaround

9
FreeBSD Security Advisories

• Example
• Solution
• Upgrade to
• Source code patch
• Binary patch

10
Common Security Problems

• Software bugs
• FreeBSD security advisor
• portaudit (ports-mgmt/portaudit)
• Unreliable wetware
• Phishing site
• Open doors
• Account password
• Disk share with the world

11
portaudit (1)

• portaudit
• Checks installed ports against a list of security
  vulnerabilities
• portaudit Fda
• -F Fetch the current database from the FreeBSD
  servers.
• -d Print the creation date of the database.
• -a Print a vulnerability report for all
  installed packages.
• Security Output

12
portaudit (2)

• portaudit -Fda
• http//www.freshports.org/ltcategorygt/ltportnamegt
• http//www.freshports.org/databases/postgresql84-s
  erver/

auditfile.tbz
100 of 58 kB 38 kBps New database
installed. Database created Tue Nov 17 165000
CST 2009 Affected package libpurple-2.5.8 Type
of problem pidgin -- MSN overflow parsing SLP
messages. Reference lthttp//portaudit.FreeBSD.org
/59e7af2d-8db7-11de-883b-001e3300a30d.htmlgt Affec
ted package finch-2.5.8 Type of problem pidgin
-- MSN overflow parsing SLP messages. Reference
lthttp//portaudit.FreeBSD.org/59e7af2d-8db7-11de-8
83b-001e3300a30d.htmlgt 2 problem(s) in your
installed packages found. You are advised to
update or deinstall the affected package(s)
immediately.
13
portaudit (3)
14
Common trick

• Tricks
• ssh scan and hack
• ssh guard
• sshit
• Phishing
• XSS sql injection
• Objective
• Spam
• Jump gateway
• File sharing

15
Process file system - procfs

• Procfs
• A view of the system process table
• Normally mount on /proc
• mount t procfs proc /proc

16
Simple SQL injection example

• User/pass authentication
• No input validation

SELECT FROM usrTable WHERE user AND pass
SELECT FROM usrTable WHERE user test AND
pass a OR a a
17
setuid program

• passwd
• /etc/master.passwd is of mode 600 (-rw-------) !
• Setuid shell scripts are especially apt to cause
  security problems
• Minimize the number of setuid programs
• Disable the setuid execution on individual
  filesystems
• -o nosuid

zfs -chiahung- ls -al /usr/bin/passwd -r-sr-xr-
x 2 root wheel 8224 Dec 5 2200
/usr/bin/passwd
/usr/bin/find / -user root perm -4000 print
/bin/mail s Setuid root files username
18
Security issues

• /etc/hosts.equiv and /.rhosts
• Trusted remote host and user name DB
• Allow user to login (via rlogin) and copy files
  (rcp) between machines without passwords
• Format
• Simple hostname username
• Complex -hostname_at_netgroup
• -username_at_netgorup
• Example
• bar.com foo (trust user foo from host
  bar.com)
• _at_adm_cs_cc (trust all from amd_cs_cc group)
• _at_adm_cs_cc -_at_chwong
• Do not use this

19
Why not su nor sudo?

• Becoming other users
• A pseudo-user for services, sometimes shared by
  multiple users
• sudo u news s (?)
• /etc/inetd.conf
• login stream tcp nowait root /usr/libexec/rlogind
  rlogind
• notftpadm/.rhosts
• localhost wangyr
• rlogin -l news localhost

User_Alias newsTAwangyr Runas_Alias
NEWSADMnews newsTA ALL(NEWSADM) ALL
Too dirty!
20
Security tools

• nmap
• john, crack
• PGP
• CA
• Firewall
• TCP Wrapper

21
TCP Wrapper

• There are something that a firewall will not
  handle
• Sending text back to the source
• TCP wrapper
• Extend the abilities of inetd
• Provide support for every server daemon under its
  control
• Logging support
• Return message
• Permit a daemon to only accept internal connetions

22
TCP Wrapper

• TCP Wrapper
• Provide support for every server daemon under its
  control

23
TCP Wrapper

• To see what daemons are controlled by inetd, see
  /etc/inetd.conf
• TCP wrapper should not be considered a
  replacement of a good firewall. Instead, it
  should be used in conjunction with a firewall or
  other security tools

ftp stream tcp nowait root
/usr/libexec/ftpd ftpd -l ftp stream
tcp6 nowait root /usr/libexec/ftpd
ftpd -l telnet stream tcp nowait root
/usr/libexec/telnetd telnetd telnet stream
tcp6 nowait root /usr/libexec/telnetd
telnetd shell stream tcp nowait root
/usr/libexec/rshd rshd shell stream tcp6
nowait root /usr/libexec/rshd
rshd login stream tcp nowait root
/usr/libexec/rlogind rlogind login stream
tcp6 nowait root /usr/libexec/rlogind
rlogind
24
TCP Wrapper

• To use TCP wrapper
• inetd daemon must start up with -Ww option
  (default)
• Or edit /etc/rc.conf
• Edit /etc/hosts.allow
• Format
• daemonaddressaction
• daemon is the daemon name which inetd started
• address can be hostname, IPv4 addr, IPv6 addr
• action can be allow or deny
• Keyword ALL can be used in daemon and address
  fields to means everything

inetd_enable"YES" inetd_flags"-wW"
25
/etc/hosts.allow

• First rule match semantic
• Meaning that the configuration file is scanned in
  ascending order for a matching rule
• When a match is found, the rule is applied and
  the search process will stop
• example

ALL localhost, loghost _at_adm_cc_cs
allow ptelnetd pftpd sshd _at_sun_cc_cs,
_at_bsd_cc_cs, _at_linux_cc_cs allow ptelnetd pftpd
sshd zeiss, chbsd, sabsd allow identd ALL
allow portmap 140.113.17. ALL allow sendmail
ALL allow rpc.rstatd _at_all_cc_cs
140.113.17.203 allow rpc.rusersd _at_all_cc_cs
140.113.17.203 allow ALL ALL deny
26
/etc/hosts.allow

• Advance configuration
• External commands (twist option)
• twist will be called to execute a shell command
  or script
• External commands (spawn option)
• spawn is like twist, but it will not send a reply
  back to the client

The rest of the daemons are protected. telnet
ALL \ severity auth.info \
twist /bin/echo "You are not welcome to use d
from h."
We do not allow connections from
example.com ALL .example.com \ spawn
(/bin/echo a from h attempted to access d gtgt
\ /var/log/connections.log) \ deny
27
/etc/hosts.allow

• Wildcard (PARANOID option)
• Match any connection that is made from an IP
  address that differs from its hostname
• See
• man 5 hosts_access
• man 5 hosts_options

Block possibly spoofed requests to sendmail
sendmail PARANOID deny
28
When you perform any change.

• Philosophy of SA
• Know how things really work.
• Plan it before you do it.
• Make it reversible
• Make changes incrementally.
• Test before you unleash it .